Google Google Certifications PROFESSIONAL-CLOUD-ARCHITECT Questions & Answers

• Question 1:

  For this question, refer to the Mountkirk Games case study. Mountkirk Games wants to migrate from their current analytics and statistics reporting model to one that meets their technical requirements on Google Cloud Platform. Which two steps should be part of their migration plan? (Choose two.)

  A. Evaluate the impact of migrating their current batch ETL code to Cloud Dataflow.

  B. Write a schema migration plan to denormalize data for better performance in BigQuery.

  C. Draw an architecture diagram that shows how to move from a single MySQL database to a MySQL cluster.

  D. Load 10 TB of analytics data from a previous game into a Cloud SQL instance, and run test queries against the full dataset to confirm that they complete successfully.

  E. Integrate Cloud Armor to defend against possible SQL injection attacks in analytics files uploaded to Cloud Storage.

  Correct Answer: AB

• Question 2:

  For this question, refer to the Mountkirk Games case study. You need to analyze and define the technical architecture for the compute workloads for your company, Mountkirk Games. Considering the Mountkirk Games business and technical requirements, what should you do?

  A. Create network load balancers. Use preemptible Compute Engine instances.

  B. Create network load balancers. Use non-preemptible Compute Engine instances.

  C. Create a global load balancer with managed instance groups and autoscaling policies. Use preemptible Compute Engine instances.

  D. Create a global load balancer with managed instance groups and autoscaling policies. Use non-preemptible Compute Engine instances.

  Correct Answer: D

• Question 3:

  For this question, refer to the Mountkirk Games case study. Mountkirk Games wants to design their solution for the future in order to take advantage of cloud and technology improvements as they become available. Which two steps should they take? (Choose two.)

  A. Store as much analytics and game activity data as financially feasible today so it can be used to train machine learning models to predict user behavior in the future.

  B. Begin packaging their game backend artifacts in container images and running them on Kubernetes Engine to improve the availability to scale up or down based on game activity.

  C. Set up a CI/CD pipeline using Jenkins and Spinnaker to automate canary deployments and improve development velocity.

  D. Adopt a schema versioning tool to reduce downtime when adding new game features that require storing additional player data in the database.

  E. Implement a weekly rolling maintenance process for the Linux virtual machines so they can apply critical kernel patches and package updates and reduce the risk of 0-day vulnerabilities.

  Correct Answer: BC

• Question 4:

  For this question, refer to the Mountkirk Games case study. Mountkirk Games wants you to design a way to test the analytics platform's resilience to changes in mobile network latency. What should you do?

  A. Deploy failure injection software to the game analytics platform that can inject additional latency to mobile client analytics traffic.

  B. Build a test client that can be run from a mobile phone emulator on a Compute Engine virtual machine, and run multiple copies in Google Cloud Platform regions all over the world to generate realistic traffic.

  C. Add the ability to introduce a random amount of delay before beginning to process analytics files uploaded from mobile devices.

  D. Create an opt-in beta of the game that runs on players' mobile devices and collects response times from analytics endpoints running in Google Cloud Platform regions all over the world.

  Correct Answer: C

• Question 5:

  Your agricultural division is experimenting with fully autonomous vehicles. You want your architecture to promote strong security during vehicle operation.

  Which two architectures should you consider? (Choose two.)

  A. Treat every micro service call between modules on the vehicle as untrusted.

  B. Require IPv6 for connectivity to ensure a secure address space.

  C. Use a trusted platform module (TPM) and verify firmware and binaries on boot.

  D. Use a functional programming language to isolate code execution cycles.

  E. Use multiple connectivity subsystems for redundancy.

  F. Enclose the vehicle's drive electronics in a Faraday cage to isolate chips.

  Correct Answer: AC

• Question 6:

  Operational parameters such as oil pressure are adjustable on each of TerramEarth's vehicles to increase their efficiency, depending on their environmental conditions. Your primary goal is to increase the operating efficiency of all 20 million cellular and unconnected vehicles in the field.

  How can you accomplish this goal?

  A. Have you engineers inspect the data for patterns, and then create an algorithm with rules that make operational adjustments automatically

  B. Capture all operating data, train machine learning models that identify ideal operations, and run locally to make operational adjustments automatically

  C. Implement a Google Cloud Dataflow streaming job with a sliding window, and use Google Cloud Messaging (GCM) to make operational adjustments automatically

  D. Capture all operating data, train machine learning models that identify ideal operations, and host in Google Cloud Machine Learning (ML) Platform to make operational adjustments automatically

  Correct Answer: B

  References: https://cloud.google.com/customers/ocado/

• Question 7:

  For this question, refer to the Mountkirk Games case study. You need to analyze and define the technical architecture for the database workloads for your company, Mountkirk Games. Considering the business and technical requirements, what should you do?

  A. Use Cloud SQL for time series data, and use Cloud Bigtable for historical data queries.

  B. Use Cloud SQL to replace MySQL, and use Cloud Spanner for historical data queries.

  C. Use Cloud Bigtable to replace MySQL, and use BigQuery for historical data queries.

  D. Use Cloud Bigtable for time series data, use Cloud Spanner for transactional data, and use BigQuery for historical data queries.

  Correct Answer: D

• Question 8:

  JencoMart has decided to migrate user profile storage to Google Cloud Datastore and the application servers to Google Compute Engine (GCE). During the migration, the existing infrastructure will need access to Datastore to upload the data.

  What service account key-management strategy should you recommend?

  A. Provision service account keys for the on-premises infrastructure and for the GCE virtual machines (VMs)

  B. Authenticate the on-premises infrastructure with a user account and provision service account keys for the VMs

  C. Provision service account keys for the on-premises infrastructure and use Google Cloud Platform (GCP) managed keys for the VMs

  D. Deploy a custom authentication service on GCE/Google Kubernetes Engine (GKE) for the on-premises infrastructure and use GCP managed keys for the VMs

  Correct Answer: C

  Migrating data to Google Cloud Platform

  Let's say that you have some data processing that happens on another cloud provider and you want to transfer the processed data to Google Cloud Platform. You can use a service account from the virtual machines on the external cloud to push the data to Google Cloud Platform. To do this, you must create and download a service account key when you create the service account and then use that key from the external process to call the Cloud Platform APIs.

  References: https://cloud.google.com/iam/docs/understanding-service-accounts#migrating_data_to_google_cloud_platform

• Question 9:

  A few days after JencoMart migrates the user credentials database to Google Cloud Platform and shuts down the old server, the new database server stops responding to SSH connections. It is still serving database requests to the application servers correctly.

  What three steps should you take to diagnose the problem? Choose 3 answers.

  A. Delete the virtual machine (VM) and disks and create a new one

  B. Delete the instance, attach the disk to a new VM, and investigate

  C. Take a snapshot of the disk and connect to a new machine to investigate

  D. Check inbound firewall rules for the network the machine is connected to

  E. Connect the machine to another network with very simple firewall rules and investigate

  F. Print the Serial Console output for the instance for troubleshooting, activate the interactive console, and investigate

  Correct Answer: CDF

  D: Handling "Unable to connect on port 22" error message Possible causes include:

  There is no firewall rule allowing SSH access on the port. SSH access on port 22 is enabled on all Compute Engine instances by default. If you have disabled access, SSH from the Browser will not work. If you run sshd on a port other than

  22, you need to enable the access to that port with a custom firewall rule.

  The firewall rule allowing SSH access is enabled, but is not configured to allow connections from GCP Console services. Source IP addresses for browser-based SSH sessions are dynamically allocated by GCP Console and can vary from

  session to session.

  F: Handling "Could not connect, retrying..." error You can verify that the daemon is running by navigating to the serial console output page and looking for output lines prefixed with the accounts-from-metadata: string. If you are using a standard image but you do not see these output prefixes in the serial console output, the daemon might be stopped. Reboot the instance to restart the daemon.

  References: https://cloud.google.com/compute/docs/ssh-in-browser

• Question 10:

  The JencoMart security team requires that all Google Cloud Platform infrastructure is deployed using a least privilege model with separation of duties for administration between production and development resources.

  What Google domain and project structure should you recommend?

  A. Create two G Suite accounts to manage users: one for development/test/staging and one for production. Each account should contain one project for every application

  B. Create two G Suite accounts to manage users: one with a single project for all development applications and one with a single project for all production applications

  C. Create a single G Suite account to manage users with each stage of each application in its own project

  D. Create a single G Suite account to manage users with one project for the development/test/staging environment and one project for the production environment

  Correct Answer: C

  Note: The principle of least privilege and separation of duties are concepts that, although semantically different, are intrinsically related from the standpoint of security. The intent behind both is to prevent people from having higher privilege levels than they actually need Principle of Least Privilege: Users should only have the least amount of privileges required to perform their job and no more. This reduces authorization exploitation by limiting access to resources such as targets, jobs, or monitoring templates for which they are not authorized. Separation of Duties: Beyond limiting user privilege level, you also limit user duties, or the specific jobs they can perform. No user should be given responsibility for more than one related function. This limits the ability of a user to perform a malicious action and then cover up that action.

  References: https://cloud.google.com/kms/docs/separation-of-duties